We have a firewall out of our firm network and administrators connect to this firewall by VPN over TLS. Scanning this firewall, the vulnerability scanner get us some warning as the 443 port allow weak ciphers & hash functions like RC4, MD5, SHA1, 3DES ...
So we asked firewall manufacturer how to fix it and they responded that's not possible to remove cipher suite, but as we don't use those ciphers (client side) it's not a vulnerability.
It seems like an easy response to get rid of us. So what is the risk to allow weak ciphers if we use/enforce strong cipher on the client side ?